Re: Security log in Event Viewer

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Morten Madsen (MortenMadsen_at_discussions.microsoft.com)
Date: 09/07/04 

Date: Tue, 7 Sep 2004 01:39:08 -0700

Hi Marina

I am not sure what details you would like from the event log. The security
log contains 174.661 events - and thats just from the last month, with only
very little use of the server.

An exemple goes like this (this is always the <servername>$ user):
08:00:15, Success Audit, Logon/logoff, Event 576
08:00:15, Success Audit, Logon/logoff, Event 540
08:00:23, Success Audit, Logon/logoff, Event 538
08:01:09, Success Audit, Logon/logoff, Event 538
08:02:10, Success Audit, Logon/logoff, Event 538
08:02:15, Success Audit, Logon/logoff, Event 576
08:02:15, Success Audit, Logon/logoff, Event 540
08:02:26, Success Audit, Logon/logoff, Event 576
08:02:26, Success Audit, Logon/logoff, Event 540
08:02:35, Success Audit, Logon/logoff, Event 576
08:02:35, Success Audit, Logon/logoff, Event 540
08:02:35, Success Audit, Logon/logoff, Event 576
08:02:35, Success Audit, Logon/logoff, Event 540
08:02:35, Success Audit, Logon/logoff, Event 538
08:02:35, Success Audit, Logon/logoff, Event 538
08:02:39, Success Audit, Logon/logoff, Event 538
08:03:17, Success Audit, Logon/logoff, Event 576
08:03:17, Success Audit, Logon/logoff, Event 540
08:00:17, Success Audit, Logon/logoff, Event 576
... and on and on it goes.
I you would like more details, please specify the best way to give you the
information.

Thanks,
Morten

"Marina Roos [SBS-MVP]" wrote:

> Hi Morten,
>
> Can you post such an event?
>
> --
> Regards,
>
> Marina
> Microsoft SBS-MVP
>
> "Morten Madsen" <Morten Madsen@discussions.microsoft.com> schreef in bericht
> news:EEBA3C82-F4DC-4F60-B742-7459A8FED4D3@microsoft.com...
> > Hi,
> > I have recently installed a SBS2003 and we are about to begin using it
> with
> > 30 users. Looking through the event logs, I found out that a special user
> > keeps loggin on and off all the time, filling up the security log in the
> > event viewer.
> > The user is <servername>$ and this user keeps logging on and off all the
> > time, about 20 times during a 5 min period. It stays logged on for a few
> > minuttes and then logs off again, and immidiately logs on again.
> > Anybody have an idea about what I have configured wrong and how I can fix
> > this?
> >
> > Best regards
> > Morten Madsen
>
>
>

Relevant Pages

  • Re: Security log in Event Viewer
    ... > 08:00:15, Success Audit, Logon/logoff, Event 576 ... >> Microsoft SBS-MVP ... >>> Best regards ...
    (microsoft.public.windows.server.sbs)
  • RE: Remote Desktop for Admin immediately logs off
    ... When I attempt to log on to the computer, the following events show up in the Security log, nothing shows up in the Application or System logs. ... Success Audit: Security: Logon/Logoff: 552: ...
    (microsoft.public.windows.terminal_services)
  • Re: windows explorer suddenly very slow loading files
    ... Success Audit 19/12/2008 Security Privilege Use 576 ... Success Audit 19/12/2008 Security Logon/Logoff 528 ... Success Audit 18/12/2008 Security Policy Change 850 ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Security Logs
    ... They are all logon/logoff but the majority of them are system and not users. ... This seems to be what is filling up the logs so quickly ... > this by setting the security settings in Domain Controller Security ...
    (microsoft.public.win2000.security)
  • Re: NT AUTHORITYSYSTEM
    ... > Event Source: Security ... > Event Category: Logon/Logoff ... Looking for spyware or any other maliciuos program on your server and on ... Security Manager ...
    (microsoft.public.windows.server.general)